Changes to Alias ResolvingWhen a wallet is accessed using an alias if the browser does not already have the wallet identifier saved or have an authorised login session email authorisation will now be required.
If the browser is perviously recognised by blockchain no authorisation is required. Wallets can still be accessed directly by identifier, which provides 128 bits of entropy and
should always be kept secret.
For example if you visit my personal wallet:
https://blockchain.info/wallet/piuk if will appear as if no wallet exists however I will receive an authorisation email.
A number of users have reported their wallet being compromised to me, the exact cause is unknown (I suspect malware) however in pretty much all cases the user has set a wallet alias which is the same as their bitcointalk username (and used on other sites). This is common practice, however it much more secure if the wallet identifier and alias are kept secret. The above changes are meant to address this problem.
I will respond to the above posts shortly, apologies for the delay.
